linux-kernel - Re: [PATCH] x86, kaslr: propagate base load address calculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1502110001480.10719@pobox.suse.cz>
Date:	Wed, 11 Feb 2015 00:07:12 +0100 (CET)
From:	Jiri Kosina <jkosina@...e.cz>
To:	Kees Cook <keescook@...omium.org>
cc:	"H. Peter Anvin" <hpa@...ux.intel.com>,
	LKML <linux-kernel@...r.kernel.org>,
	live-patching@...r.kernel.org, Linux-MM <linux-mm@...ck.org>,
	"x86@...nel.org" <x86@...nel.org>
Subject: Re: [PATCH] x86, kaslr: propagate base load address calculation

On Tue, 10 Feb 2015, Kees Cook wrote:

> > Instead of fixing the logic in module.c, this patch takes more generic
> > aproach, and exposes __KERNEL_OFFSET macro, which calculates the real
> > offset that has been established by choose_kernel_location() during boot.
> > This can be used later by other kernel code as well (such as, but not
> > limited to, live patching).
> >
> > OOPS offset dumper and module loader are converted to that they make use
> > of this macro as well.
> >
> > Signed-off-by: Jiri Kosina <jkosina@...e.cz>
> 
> Ah, yes! This is a good clean up. Thanks! I do see, however, one
> corner case remaining: kASLR randomized to 0 offset. This will force
> module ASLR off, which I think is a mistake. 

Ah, right, good point. I thought that zero-randomization is not possible, 
but looking closely, it is.

> Perhaps we need to export the kaslr state as a separate item to be 
> checked directly, instead of using __KERNEL_OFFSET?

I wanted to avoid sharing variables between compressed loader and the rest 
of the kernel, but if that's what you prefer, I can do it.

Alternatively, we can forbid zero-sized randomization, and always enforce 
at least some minimal offset to be chosen in case zero would be chosen.

I think that'd be even more bulletproof for any future changes, as it 
automatically clearly and immediately distinguishes between 'disabled' and 
'randomized' states, and the loss of entropy is negligible.

Let me know which of the two you'd prefer; I'll then send you a 
corresponding patch, as I don't have a strong opinion either way.

Thanks,

-- 
Jiri Kosina
SUSE Labs
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/